Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1676912

Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend

Show all headers | View raw

On Mon, Jun 26, 2017 at 08:33:59AM -0400, Mimi Zohar wrote:
> On Sat, 2017-06-24 at 11:03 +0200, Jarkko Sakkinen wrote:
> > On Wed, Jun 21, 2017 at 04:29:35PM +0200, Roberto Sassu wrote:
> 
> 
> > To move this forward and be more constructive here's how I see it
> > should be done (along the lines, draft):
> > 
> > int tpm_pcr_extend(u32 chip_num, int pcr_idx, unsigned int alg,
> > 		   const u8 *hash);
> > 
> > The paramater 'alg' is crypto ID as specified by crypto subsystem.
> 
> Based on Kenneth Goldman's input, the new IMA TPM-2.0 crypto hash
> agile measurement list will contain the TPM crypto hash algorithm ids
> (TPM crypto-ID). 

Doesn't this lock you to TPM? 

If you seriously want to do this, I guess it is fine by me but I'm just
wondering why the measurement list couldn't use something with more
loose binding to TPM.

> > TPM driver must have a precompiled table of mappings for crypto IDs
> > and TPM algorithm IDs.
> 
> We could map the TPM crypto-IDs to the crypto subsystem IDs and then
> map them back, but is that necessary?
> 
> > 
> > In addition it must have dynamically acquired list of TPM alg IDs.
> > For those algs that static mapping does not exist it must extend
> > them like we do now everything else except SHA-1 (Naynas changes).
> 
> Padding/truncating an unknown bank using SHA1 is fine, but at some
> point, as Roberto pointed out to me, TPM 2.0's might not support SHA-
> 1.  So for the record, we're hard coding the use of SHA1 for the
> unknown algorithms whether or not the TPM supports SHA1.

Why doesn't it work to pick algorithm X from the availabe options and
do truncation/padding for that? Not necessarily SHA1.

> 
> > There's absolutely no need to pass digest size like you do BTW as it is
> > defined by the standard.
> 
> For algorithms known to the crypto subsystem, that is fine, but for
> the unknown TPM crypto algorithms, we would need to somehow query the
> TPM for the digest sizes to create the mapping.
> 
> Mimi

There's a TPM command to query TPM algorithms.

/Jarkko

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
  [PATCH v3 5/6] tpm: introduce tpm_get_pcr_banks_info() Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [PATCH v3 5/6] tpm: introduce tpm_get_pcr_banks_info() Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:40 +0200
  [PATCH v3 6/6] tpm: pass multiple digests to tpm_pcr_extend() Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [tpmdd-devel] [PATCH v3 6/6] tpm: pass multiple digests to  tpm_pcr_extend() Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:40 +0200
  [PATCH v3 1/6] tpm: use tpm_buf functions to perform a PCR read Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [tpmdd-devel] [PATCH v3 1/6] tpm: use tpm_buf functions to  perform a PCR read Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-22 12:20 +0200
      Re: [tpmdd-devel] [PATCH v3 1/6] tpm: use tpm_buf functions to  perform a PCR read Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-22 14:00 +0200
        Re: [tpmdd-devel] [PATCH v3 1/6] tpm: use tpm_buf functions to  perform a PCR read Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 13:00 +0200
  [PATCH v3 4/6] tpm: replace TPM algorithms IDs with tpm_pcr_bank_info structs in tpm_chip Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [PATCH v3 4/6] tpm: replace TPM algorithms IDs with  tpm_pcr_bank_info structs in tpm_chip Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:40 +0200
  [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info structure with digest_size from TPM Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-21 16:40 +0200
    Re: [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info structure with  digest_size from TPM Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-23 12:30 +0200
      Re: [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info structure with  digest_size from TPM Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-23 13:30 +0200
    Re: [tpmdd-devel] [PATCH v3 3/6] tpm: introduce tpm_pcr_bank_info  structure with digest_size from TPM Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-27 17:30 +0200
  Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-24 11:10 +0200
    Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-26 09:00 +0200
    Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-26 09:30 +0200
      Re: [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-28 20:00 +0200
    Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-26 14:40 +0200
      Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Roberto Sassu <roberto.sassu@huawei.com> - 2017-06-26 17:00 +0200
        Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-26 19:20 +0200
      Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-06-28 20:00 +0200
        Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR  extend Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-06-29 00:30 +0200

csiph-web